SUSE CVE-2026-97570

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

SUSE CVE-2026-97580

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

SUSE CVE-2026-98020

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

MGASA-2026-0463 Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

CVE-2026-51874

In Devika v1.0 , the Patcher Agent 's save_code_to_project function is susceptible to a path traversal vulnerability (CWE-22). This flaw allows an attacker to write files outside of the intended project workspace. The vulnerability has been observed in the wild, as evidenced by a sighting report....

PT-2026-104034

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description The save code to project function within the Feature Agent contains a path traversal flaw. This issue allows attackers to write files outside the designated project workspace, which could lead to a full server...

PT-2026-104032

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description An issue exists in the save code to project function of the Coder module. This flaw enables directory traversal, a technique that allows an attacker to access or write files outside the intended project workspace...

PT-2026-104040

Name of the Vulnerable Software and Affected Versions Langchain-Chatchat version 0.3.0 Description The OpenAI-compatible file upload endpoint /v1/files is susceptible to path traversal, a condition where an attacker can access or write files outside the intended directory. By crafting malicious...

PT-2026-104038

Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description A path traversal issue exists in the EditFileTool.execute function. A remote caller can use the live tutorbot WebSocket interface to force the tool layer to write or edit absolute paths outside the designate...

PT-2026-104033

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description The Patcher Agent save code to project function contains a path traversal flaw. This issue allows attackers to write files outside the intended project workspace by manipulating file paths. Recommendations As a...

CVE-2026-51873

Devika v1.0 is vulnerable to a Directory Traversal flaw within the Coder.save_code_to_project function. This vulnerability allows an attacker to manipulate file paths to write files outside the intended project workspace. While no direct exploit code is provided in the documents, a sighting was r...

PT-2026-105864

Summary External knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for othe...

CVE-2026-79900: Out-of-bounds Write

boksksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can...

PT-2026-105583

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...

CVE-2026-51873: Undefined Security Weakness

Devika v1.0 is vulnerable to Directory Traversal in the Coder.savecodetoproject function, which allows attackers to write files outside the intended project workspace...

CVE-2026-102514: Out-of-bounds Write

Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...

CVE-2026-51882

The Langchain-Chatchat version 0.3.0 contains a path traversal vulnerability in its OpenAI-compatible file upload endpoint, /v1/files. An attacker can craft malicious filenames to write files to arbitrary locations outside the intended openai_files directory. This vulnerability has been exploited...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

PT-2026-104044

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.8.5 Description A directory traversal flaw exists where a public-facing HTTP route handler forwards attacker-controlled paths or filenames into host file creation without boundary enforcement. This allo...